One time passwords are being deployed by larger websites including Google, Facebook, GitHub, LinkedIn etc but they have their ups and downs. What type of OTP should you use; the YubiKey OTP, OATH HOTP, or OATH TOTP? How would you validate the OTP; building your own server and protecting the secrets, or rely on a cloud service like Yubico's YubiCloud or VeriSign VIP? The talk will also cover the future of two-factor authentication with the FIDO Universal 2nd Factor (U2F) protocol.

+

+

Klas Lindfors is a software developer at Yubico, working with one time passwords at all layers: firmware, personalization & validation.

+

+

+

'''Per Thorsheim'''

+

+

OWASP has some wonderful guidelines on sending, storing and resetting passwords. However there are still challenges that cannot be addressed

+

through technical measures, they need to be addressed by humans, and not just developers. Through color & font selections, association elements, password managers, human pattern analysis and more, this talk will discuss what we are still doing wrong, the risks associated with bad passwords, and give some advice on what we need to do in order to improve our online security.

+

+

Per Thorsheim is the founder & main organizer of the Passwords conferences (PasswordsCon.org), a conference fully dedicated to passwords & PINs. He's been working, examining, playing, dreaming and discusssing passwords for more than 14 years, and is still going strong. He publicly disclosed the hacking of Linkedin in june 2012, and has been interviewed and quoted around the world on his excessive interest in passwords. During daytime he tries to solve challenges for his customers through security awareness training & security advisory services. Some say he's good at explaining advanced topics to regular humans. He is certified CISA, CISM and CISSP-ISSAP.

One time passwords are being deployed by larger websites including Google, Facebook, GitHub, LinkedIn etc but they have their ups and downs. What type of OTP should you use; the YubiKey OTP, OATH HOTP, or OATH TOTP? How would you validate the OTP; building your own server and protecting the secrets, or rely on a cloud service like Yubico's YubiCloud or VeriSign VIP? The talk will also cover the future of two-factor authentication with the FIDO Universal 2nd Factor (U2F) protocol.

Klas Lindfors is a software developer at Yubico, working with one time passwords at all layers: firmware, personalization & validation.

Per Thorsheim

OWASP has some wonderful guidelines on sending, storing and resetting passwords. However there are still challenges that cannot be addressed
through technical measures, they need to be addressed by humans, and not just developers. Through color & font selections, association elements, password managers, human pattern analysis and more, this talk will discuss what we are still doing wrong, the risks associated with bad passwords, and give some advice on what we need to do in order to improve our online security.

Per Thorsheim is the founder & main organizer of the Passwords conferences (PasswordsCon.org), a conference fully dedicated to passwords & PINs. He's been working, examining, playing, dreaming and discusssing passwords for more than 14 years, and is still going strong. He publicly disclosed the hacking of Linkedin in june 2012, and has been interviewed and quoted around the world on his excessive interest in passwords. During daytime he tries to solve challenges for his customers through security awareness training & security advisory services. Some say he's good at explaining advanced topics to regular humans. He is certified CISA, CISM and CISSP-ISSAP.

What is SSL/TLS and HTTPS? What security is it intended to provide? In recent years the SSL/TLS and HTTPS technology has been had numerous alerts on real world, practical crypto attacks, effectively
unravelling HTTPS security promises. What are these attacks, why do they work, and how were the attacks combatted in SSL implementations?

Joachim Strömbergson

Joachim Strömbergson is a security expert at Secworks, a consultancy
founded by Joachim. By working as an advisor and educator, providing
analysis and implementations Joachim assists his customers in finding
the right security for their products and services. SSL and TLS in
embedded systems, Internet of Things and SCADA system security are
things Joachims battles during day time. On his spare time Joachim
implements ciphers and blogs about security at secworks.se

Peter Magnusson

Peter is a speaker in the Säkerhetspodcasten security podcast
(sakerhetspodcasten.se) and has a great interest in applied cryptography
and practical cryptographic attacks. Peter works as security consultant at
Omegapoint and specialize in application security.

We present the OWASP top ten list for 2013. The top ten list contains the most serious application security risks. In the top of the list we find SQL injection. Well known, but still going strong, due to the potentially disastrous consequences a successful attack may have. In the upper half of the list, we also find broken authentication and, of course, Cross-Site Scripting. Among the newcomers to the list, we find sensitive data exposure, and the use of components with known vulnerabilities. In addition to presenting the list, we also demonstrate some simple attacks.

Jonas

In a heterogeneous system like the web, information is exchanged between components in versatile formats. A new breed of attacks is on the rise that exploit the mismatch between the expected and provided content. This paper focuses on the root cause of a large class of attacks: polyglots. A polyglot is a program that is valid in multiple programming languages. Polyglots allow multiple interpretation of the content, providing a new space of attack vectors. We characterize what constitutes a dangerous format in the web setting and identify particularly dangerous formats, with PDF as the prime example. We demonstrate that polyglot-based attacks on the web open up for insecure communication across Internet origins. The paper presents novel attack vectors that infiltrate the trusted origin by syntax injection across multiple languages and by content smuggling of malicious payload that appears formatted as benign content. The attacks lead to both cross-domain leakage and cross-site request forgery. We perform a systematic study of PDF-based injection and content smuggling attacks. We evaluate the current practice in client/server content filtering and PDF readers for polyglot-based attacks, and report on vulnerabilities in the top 100 Alexa web sites. We identify five web sites to be vulnerable to syntax injection attacks. Further, we have found two major enterprise cloud storage services to be susceptible to content smuggling attacks. Our recommendations for protective measures on server side, in browsers, and in content interpreters (in particular, PDF readers) show how to mitigate the attacks.

Mario Heiderich is founder of the German/UK pen-test outfit Cure53 and a Microsoft security contractor. He focuses on HTML5, SVG security, script-less attacks and believes XSS can be eradicated by using JavaScript. Maybe. Some day. Actually quite soon. Mario invoked the HTML5 security cheat-sheet, the Alexa Top 1x search engine Crawly and several other projects. In the remaining time he delivers trainings and security consultancy for larger German and international companies for sweet sweet money and the simple minded fun in breaking things. Mario has spoken on a large variety of international conferences - both academic and industry-focused, co-authored two books, several academic papers and doesn't see a problem in his one year old son having a tablet already. There you have it.

The InnerHTML Apocalypse - How mXSS Attacks change everything we believed we knew so far

This talk introduces and discusses a novel, mostly unpublished technique to successfully attack websites that are applied with state-of-the-art XSS protection. This attack labeled Mutation-XSS (mXSS) is capable of bypassing high-end filter systems by utilizing the browser and its unknown capabilities - every single f***** one of them. We analyzed the type and number of high-profile websites and applications that are affected by this kind of attack. Several live demos during the presentation will share these impressions and help understanding, what mXSS is, why mXSS is possible and why it is of importance for defenders as well as professional attackers to understand and examine mXSS even further. The talk wraps up several years of research on this field, shows the abhorrent findings, discusses the consequences and delivers a step-by-step guide on how to protect against this kind of mayhem - with a strong focus on feasibility and scalability.

XSS from 1999 to 2013: The "Doctrine Classique" of Websecurity

XSS attacks were first documented about 15 years ago. Since then, the attack technique has undergone an evolution, that resembles the classic dramatic theory - including catastasis, heroism, villainy and peripeteia.

Now, HTML and JavaScript enter the world of operating systems and the XSS tragedy is on the verge of becoming a nightmare beyond human control. The once harmless "alert" is now a black swan of code execution, the phantom of the browser, Gretchen and Mephistopheles at the same time.

This talk attempts to go back into the early past and unveil the causes for XSS, point fingers at the true evil that made the Internet what it is today, outline our mistakes and the general failure of the fat-bellied websecurity community and try to leave the hope, that not all will be lost in the realms of the WWW.

As with most things in life, dealing with security incidents is something you need to prepare and train for. Once a security incident has been declared you will need to do a number of things simultaneously, an essential part of which is the gathering of evidence to the facts. There are lots of considerations to be made and usually a lot of people to lead and/or coordinate. Understanding the risks and the pit-falls, working disciplined, knowing the dos and don’ts and keeping a cool head may very well save the day. Even of you as an incident handler do not do the actual forensics, you need to know what happens, when and how, in order to make the best of the possibilities you have - as you are always at a disadvantage of the perpetrator.

I am a Senior Security Investigator at TeliaSonera CERT Coordination Centre, I have my offices in Copenhagen, but TS-CERT serve the entire TeliaSonera Group and fully owned companies in 17 countries. I have more than 25 years of experience in working with IT and 12 of those have been spent as a security professional. I have been half of that at DK*CERT, UNI-C, the CERT for the Danish education- and research network as well as the general public and the rest in various functions at TeliaSonera. I have also worked independently, doing forensics, for the Danish Police, several news media and as a specialist for the Danish Judicial system. I am a GIAC certified Forensics analyst and Incident Handler and do most of the ‘hands-on’ disciplines within IT and Mobile Forensics as well as penetration testing, security auditing and most, if not all other aspects of IT security and physical security. I am not and do not wish to be a public figure.

Rikard Bodforss

Understanding of how different acquisition methods affect the system is important when examining the collected evidence and can be critical if the case ends up in a court of law. Rikard will give a hands-on demonstration of forensic artifacts from different routine tasks. The demonstration will give a basic understanding of how delicate the system is and why some acquisition methods leave a bigger footprint than others.

Rikard Bodforss is a security advisor at Omegapoint in Gothenburg, Sweden. He has over twenty years of experience from the IT industry and most of that working with information- and IT-security. He has held positions as Global Perimeter Protection Manager and Head of Forensics within Volvo Group. Now he is working with clients from many different industries like; critical public utilities (SCADA security), banking, automotive, retail and trade. His area of expertise ranges from very technical security, like forensics, to information security governance.
Rikard holds a CISSP and a CISA certification, and was awarded the ISACA Thomas Fitzgerald Award in 2009 for acheiving the highest score in the world on the CISA exam. He is a very popular speaker at national and international conferences and promises to deliver a talk you do not want to miss!
You can follow him on Twitter @rbodforss and listen to him (in Swedish) at sakerhetspodcastem.se where he is a co-host.

'Mattias Weckstén

A short talk about the IT-forensic program at Halmstad university, our view of the IT-forensic investigator, courses and skills taught and the future of the trade. The talk will be concluded with an overview of a selection of previous and current thesis projects.

Mattias is adjunct in computer engineering with a specialization in it-forensics at Halmstad University. Teaching a multitude of technical aspects of the trade of manual digital forensics. Promoting it-forensic awareness through popular science in modern media.

In this talk, we look at some common security pitfalls in mobile application development. We also take a peek inside the iGoat training application, an OWASP project aimed at educating mobile developers in secure programming. Finally, we look briefly on how to you can assess the security of your backend by using burp proxy to intercept and modify your mobile phone’s traffic in transit.

3-from-1 Mikko Saario

In the first part of the talk, Mikko will take a quick look at various hybrid environments available for ‘mobile’ app developers – showing how the ‘desktop web’ and ‘mobile web’ are converging and what kind of fundamental security mechanisms do or do not exist in them to protect the user. The second part will take a look at recent developments in the web standards bridging these two worlds even closer to each other than ever before – perhaps even making native apps … redundant at some point? Finally, switching to something completely different, Mikko will share his experiences working with an agile team and helping them build more secure products. The talks are accompanied with small demos and use cases to show some of the discussed topics in real life.

Developers frequently see the need to be able to request data from several sources on different domains.
Traditionally this has been solved in many ways, some of them not very secure. We will take a look at
some of these approaches, why they are flawed, and why the new approaches are better. We will also
look at common mistakes made when setting up cross domain communication.
We will also take a look at some of the new browser security features, and how these support cross
domain communication and can help mitigate other security problems.

Jim Manico is a profile in the OWASP community, working with the OWASP podcasts and ESAPI amongst other things. During March he is doing a Nordic tour and will be visiting the chapters in Finland, Sweden, Norway and Denmark and we have the pleasure of welcoming him to Gothenburg on March 22.

Chalmers University of Technology is sponsoring the venue and will also provide some light snacks, coffee beer as well as non-alcoholic drinks. Jim's visit is made possible thanks to F5.

Please note that the event will be held in English.

Abstract: Web Application Access Control Design Excellence
Access Control is a necessary security control at almost every layer within a web application. This talk will discuss several of the key access control anti-patterns commonly found during website security audits. These access control anti-patterns include hard-coded security policies, lack of horizontal access control, and "fail open" access control mechanisms.

In reviewing these and other access control problems, we will discuss and design a positive access control mechanism that is data contextual, activity based, configurable, flexible, and deny-by-default - among other positive design attributes that make up a robust web-based access-control mechanism.

Martin Holst Swende is a security consultant at the Swedish company 2Secure, where he primarily is involved with application security testing, but also does network penetration testing, IT forensics and source code auditing. Martin has a background as an Ms.C in Computer Science and Engineering from Linköping University and worked as a software developer for among others Yahoo before entering the field of security. Martin is the project leader for the Owasp Hatkit and the Owasp Hatkit Datafiddler projects.

Presentation abstract

The Hatkit Project was created to provide a framework for web application security testing. It consists of two parts; the Hatkit Proxy and the Hatkit Datafiddler. The proxy is a minimalist intercepting proxy which records data to a MongoDB database, while the Datafiddler is a tool to view, sort, filter, aggregate, replay and analyse data through a lot of different mechanisms, with the aim of providing a highly customizable framework which can be used to analyse modern complex web applications.
The tools became Owasp projects in 2011.

Stefano Di Paola is the CTO and a cofounder of Minded Security, where he is responsible for the Research and Development Lab. Prior to founding Minded Security, Stefano was a freelance security consultant, working for several private and public companies. He also worked in collaboration with University of Florence at the Faculty of Computer Engineering. Stefano is recognized as one of the top application security researchers. In past years he released several cutting edge security advisories and researches presented at several international events (Flash application security testing, Subverting Ajax). He is the Research & Development Director of OWASP Italian Chapter and contributor to several chapters of the OWASP testing guide.

Presentation abstract

Cross Site Scripting is one of the most difficult issues to fix since it involves several contexts on different platforms. And it is well known. With the advent of complex web application with heavy client side programming, DOM based Cross Site Scripting is becoming more and more interesting in the application security field. The difference between vanilla Xss and the latter is how hard is to find issues among thousands of JavaScript lines of code, and how contexts and attacks move from classical HTML format and client side execution to programming logic and paradigms. This talk will try to fill the emptiness of awareness about DOM Xss by showing new attacks and a new analysis technique whose implementation is a tool named "DOMinator". DOMinator is a Firefox based application that can ease the pain of finding DOM based Cross Site Scripting issues by using runtime tainting analysis at JavaScript level.

15 years ago the concept of "Same-Origin Policy" (SOP) was introduced. SOP controls the interaction between web browser components. Current web applications differ radically in how they interact and they also use certain "hacks" to bypass the outdated policy. Jonas Magazinius introduces ongoing research at Chalmers University regarding programming language security and how a fine granular policy can replace SOP by allowing more interaction without compromising security.

Omegapoint are sponsors and there will be lighter food and beers. Omegapoint is located at Rosenlundsgatan 3, Göteborg. The event will start at 5 pm and end around 8 pm. To sign up for the event, please visit this site.

July 4th, 2011 - OWASP-Gothenburg opens!

Finally, OWASP Gothenburg has been formed, bringing application security closer to developers and security professionals on the west coast of Sweden. Ulf, Mattias and Jonas, the local chapter leaders, welcome members!

Deltagande

OWASP Foundation is a professional association of global members and is and open to anyone interested in learning more about application security. Local chapters are run independently and governed by the following Chapter Leader Handbook. As a 501(c)(3) non-profit professional association your support and sponsorship of a meeting venue and/or refreshments is tax-deductible. Financial contributions should be made online using the online chapter donation button. To be a SPEAKER at ANY OWASP Chapter in the world simply review the speaker agreement and then contact the local chapter leader with details of what OWASP PROJECT, independent research or related software security topic you would like to present on.